Cloudflare.Intel reference

IndicatorFeed

Source: src/Cloudflare/Intel/IndicatorFeed.ts

A Cloudflare custom Indicator Feed (Cloudforce One threat intelligence).

Indicator feeds let approved accounts publish their own threat-intel indicators (domains, IPs, URLs) that consumer accounts can subscribe to via Gateway or download directly. Creating feeds requires the account to be approved as a feed provider (a Cloudforce One entitlement) — without it, creation fails with the typed IndicatorFeedsNotEntitled error.

Cloudflare’s API exposes no delete endpoint for indicator feeds. Destroying this resource orphans the feed on Cloudflare’s side (a warning is logged). To avoid leaking feeds across deployments, the provider adopts an existing feed with the same name instead of creating a duplicate.

IndicatorFeed: Creating a Feed

Basic feed

const feed = yield* Cloudflare.Intel.IndicatorFeed("threat-feed", {
  description: "Indicators observed by our honeypots",
});

Public, downloadable feed

const feed = yield* Cloudflare.Intel.IndicatorFeed("public-feed", {
  name: "acme-public-indicators",
  description: "Acme Corp public threat indicators",
  isPublic: true,
  isDownloadable: true,
  isAttributable: true,
});

IndicatorFeed: Publishing Indicators

const feed = yield* Cloudflare.Intel.IndicatorFeed("threat-feed", {
  description: "Indicators observed by our honeypots",
  snapshot: JSON.stringify({
    type: "bundle",
    id: "bundle--0a242344-3c0b-4fdb-9f59-3e8c4a4f6b3a",
    objects: [],
  }),
});

IndicatorFeed: Sharing a Feed

yield* Cloudflare.Intel.IndicatorFeedPermission("partner-access", {
  feedId: feed.feedId,
  accountTag: "023e105f4ecef8ad9ca31a8372d0c353",
});

IndicatorFeedPermission

Source: src/Cloudflare/Intel/IndicatorFeedPermission.ts

A permission grant on a Cloudflare custom Indicator Feed, giving another Cloudflare account access to consume the feed.

This is an existence-only resource: it has no mutable aspects beyond its identity (feed + consumer account tag), so changing either property triggers a replacement. Cloudflare’s add/remove endpoints are idempotent PUTs, so reconcile and delete are simple ensure/remove calls.

Cloudflare exposes no API to list the grantees of a feed from the provider side (the permissions “view” endpoint lists feeds the calling account can consume), so read reports the last known state.

IndicatorFeedPermission: Granting Access

const feed = yield* Cloudflare.Intel.IndicatorFeed("threat-feed", {
  description: "Indicators observed by our honeypots",
});

yield* Cloudflare.Intel.IndicatorFeedPermission("partner-access", {
  feedId: feed.feedId,
  accountTag: "023e105f4ecef8ad9ca31a8372d0c353",
});